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Abstract 

We study in this paper a generalized coupon collector problem, which consists in analyzing 
the time needed to collect a given number of distinct coupons that are drawn from a set 
of coupons with an arbitrary probability distribution. We suppose that a special coupon 
called the null coupon can be drawn but never belongs to any collection. In this context, 
we prove that the almost uniform distribution, for which all the non-null coupons have the 
same drawing probability, is the distribution which stochastically minimizes the time needed 
to collect a fixed number of distinct coupons. Moreover, we show that in a given closed 
subset of probability distributions, the distribution with all its entries, but one, equal to the 
smallest possible value is the one, which stochastically maximizes the time needed to collect a 
fixed number of distinct coupons. An computer science application shows the utility of these 
results. 
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1 Introduction 

The coupon collector problem is an old problem, which consists in evaluating the time needed 
to get a collection of different objects drawn randomly using a given probability distribution. 
This problem has given rise to a lot of attention from researchers in various fields since it has 
applications in many scientific domains including computer science and optimization, see [2] for 
several engineering examples. 

More formally, consider a set of n coupons, which are drawn randomly one by one, with 
replacement, coupon i being drawn with probability pi. The classical coupon collector problem is 
to determine the expectation or the distribution of the number of coupons that need to be drawn 
from the set of n coupons to obtain the full collection of the n coupons. A large number of papers 
have been devoted to the analysis of asymptotics and limit distributions of this distribution when 
n tends to infinity, see [1] or [5] and the references therein. In [3] , the authors obtain new formulas 
concerning this distribution and they also provide simulation techniques to compute it as well as 
analytic bounds of it. The asymptotics of the rising moments are studied in [S]. 

We suppose in this paper that p = (pi,... ,pn) is not necessarily a probability distribution, 
i.e., we suppose that define po = 1 ~ Y^7=iPi- This means that there is a 

null coupon, denoted by 0, which is drawn with probability po, but that does not belong to the 
collection. We are interested, in this setting, in the time needed to collect c different coupons 

‘This work was partially funded by the French ANR project SocioPlug (ANR-13-INFR-0003), and by the 
DeSceNt project granted by the Labex CominLabs excellence laboratory (ANR-lO-LABX-07-01). 
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among coupons 1,..., n, when a coupon is drawn, with replacement, at each discrete time 1,2,... 
among coupons 0,1,..., n. This time is denoted by Tc_„(p) for c = 1,..., n. Clearly, Tn^nip) is 
the time needed to get the full collection. The random variable Tc,n{p) has been considered in 
in the case where the drawing probability distribution is uniform. The expected value lE[Tc^„(p)] 
has been obtained in [B] when po = 0. Its distribution and its moments have been obtained in [T] 
using Markov chains. 

In this paper, we prove that the almost uniform distribution, denoted by v and defined by 
V = (vi,... ,Vn) with Vi = (1 —po)/n, where po is fixed, is the distribution which stochastically 
minimizes the time Tc,n(p) such that po = 1 — This result was expressed as a conjecture 

in [T] where it is proved that the result is true for c = 2 and for c = n extending the sketch of the 
proof proposed in [5] to the case po > 0. It has been also proved in [T] that the result is true for 
the expectations, that is that lE[rc.n(M)] < lE[Tc_„(n)] < lE[rc.n(p)]- 

We first consider in Section 2, the case where po = 0 and then we extend it to one of po > 0. 
We show moreover in Section 3, that in a given closed subset of probability distributions, the 
distribution with all its entries, but one, equal to the smallest possible value is the one which 
stochastically maximizes the time Tc_„(p). This work is motivated by the worst case analysis of 
the behavior of streaming algorithms in network monitoring applications as shown in Section 4. 


2 Distribution minimizing the distribution of Tc,n{p) 

Recall that Tc^n(p), with p = (pi,... ,Pn), is the number of coupons that need to be drawn from 
the set {0, 1 , 2 ,..., n}, with replacement, till one first obtains a collection with c different coupons, 
I < c < n, among {I,..., n}, where coupon i is drawn with probability pi, i = 0,1,... ,n. 

The distribution of Tc^nip) bas been obtained in [I] using Markov chains and is given by 

p{r,,„(p)>fc} = 2(-ir'-*f””l"^) Y.{po+pj)\ (1) 

i =0 \ n c j ^ 

where = {J C {I,..., n} | | J| = i\ and, for every J C {I,... ,n}, Pj is defined by Pj = 
Y^jfzjPj- Note that we have So,n = 0, P 0 = 0 and = (”). 

This result also shows as expected that the function P{Tc_„(p) > k}, as a function of p, is 
symmetric, which means that it has the same value for any permutation of the entries of p. 

We recall that if X and Y are two real random variable then we say that X is stochastically 
smaller (resp. larger) than Y, and we write X <st Y (resp. Y <st X), if P{X > t} < P{F > t}, 
for all real numbers t. This stochastic order is also referred to as the strong stochastic order. 

We consider first, in the following subsection, the case where po = 0. 


2.1 The case Po = 0 

This case corresponds the fact that there is no null coupon, which means that all the coupons can 
belong to the collection. We thus have J2'i=iPi = 1- Tor all n > I, z = I,..., n and fc > 0, we 
denote by iV) the number of coupons of type i collected at instants I,..., fc. It is well-known 

(k) 

that the joint distribution of the is a multinomial distribution, i.e., for all ki,...,kn > 0 
such that have 


P{iv|'=) =fci,...,fVW =fc„} 


kl 


kp. - ■ - k, 


kl 

7P1 


( 2 ) 


(k) 

We also denote by Un ' the number of distinct coupon’s types, among I,..., n, already drawn at 
instant k. We clearly have, with probability I, Un'^ = 0, Un'^ = I and, for z = 0,..., n. 


P{C7^'=) =i}= Y, > 0, M e J and =0, J}. 

J&Si,n 
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Moreover, it is easily checked that, 


Te.„(p) > fc ^ < c. 


We then have 

p{T;,„(p)>fc} = p{c/w<c} 


Using Relation @, we obtain 


c-l 


= ^P{C/W=*} 


c—1 


E E P{AfW > 0, u e J and = 0, w ^ J}. 

i=0 JGSi,„ 


P{r,,„(p)>fc} = ^ E 


i=0 JgSi.n feG-Efc,j jeJ 


(3) 


where Ekj is the set of vectors defined by 

Ek,j = {k = {kj)jej I kj > 0, for all j £ J and Kj = k}, 
with Kj = J2j(^jkj- 

Theorem 1 For all n > 2 and p = (pi,...,p„) £ (0,1)" with ^ — 

l,...,n, we have Tc,n{p') <st Pc,n(p), where p' = {pi,... ,Pn-2,Pn-i,Pn) '^ith p'^_^ = \pn-i + 

(1 - X)pn and p'^ = {1 - X)pn -1 + Xpn, for all X £ [0,1]. 

Proof. The result is trivial for c = 1, since we have Ti^„(p) = 1, and for fc = 0 since both 

terms are equal to 1. We thus suppose now that c > 2 and fc > 1. The fact that k >1 means in 

particular that the term * = 0 in Relation ([3]) is equal to 0. We then have 

p{r,,„(p)>fc} = x: E E ( 4 ) 

i=i JeSi,n keEk,j jeJ ^ 


To simplify the notation, we denote by Ti(p) the ith term of this sum, that is 


JeSi,„ k€Ek,j jGJ 



(5) 


For i = 1, we have = {{1},..., {n}} and = {k}- The term Ti(p) is thus given by 

n 

Tiip)-T.Pr 

1=1 


Consider now the term Ti for i >2. We split the set Si^n into four subsets depending on wether 
the indices n — 1 and n belong to its elements. More precisely, we introduce the partition of the 
set Si^n in the four subsets defined by 


( 1 ) 

1, n 

( 2 ) 

2, n 

(3) 

z,n 

(4) 


{JC{1,.. 

.,n} 1 

\J\ 

{JC{1,.. 

.,n} 1 

\J\ 

{JC{1,.. 

.,n}\ 


{JC{1,.. 

.,n}\ 

l^/l 


i with n — 1 G J 
i with n — 1 ^ J 
i with n — \ £ J 
i with n — 1 ^ J 


and n ^ 
and n £ 
and n £ 
and n ^ 


J}. 


J}. 

J}. 

J}. 
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These subsets can also be written as = Si-i^n -2 U {u — 1}, = Si-i^n -2 U {n}, = 

Si- 2 ,n -2 U {n — l,n}, and = Si,n- 2 - Using these equalities, the term Ti of Relation ([SJ 
becomes 


T.ir) = E E n 

l,n —2 Ju{n- 1 } 


Pi 1 Pn-1 


k-^ ] k J 

tX',. I txn^—l. 


E E «(n|^ $ 

jgSi_i,„_2 feeBfc,ju{n} \jeJ ^ 


E 


kn- 


1 ^kn 


Pj Pn-1 P\ 


E n fc! I fc„_i! kj 


JGSi — 2,Ti — 2^G-Ek,JU{n — l,n} \j^J ^ 

k 


E E n 


k,\ 


JeSi,„_2 fcG-Efc,j \j&J ' 

Let us now introduce the sets Lk,j defined by 

Lk,j = {k = {kj)j^j I kj > 0, for all j € J and Kj < k}. 

Using these sets and, to clarify the notation, setting kn-i = i and kn = h when needed, we obtain 


Tiip) = E E ‘^dlfirT 

’i^Si—l^ri — 2 k^Lk — l,J \.j^J 


kj \ k-Kj 

Pi 1 Pn-1 


k,l j {k-Kj)\ 


Pj \ Pn 


^ E E I n ysjE {k-Kj)\ 


JGSi_i,„_2 feeifc-i.j \j€J 

k-i 

Pn 


+ E E « E 


k \ 

JeSi-2,n-2 kGLk-2,j \jeJ / e>o,h>o,e+h=k-Kj 
k-i 

Pn 


Pj-l Pn 

e\ h\ 




JGSi.„_2 fcg-Efc.j \iGJ ^ 

which can also be written as 


T^iP) = E E 


k\ 


{k - Kj)\ 
k\ 

Tk~- 

J^Si-2,n-2 kGLk_2,J 

- E E 


J€5i_l,n.-2 k^Lk-l,J 

+ E E 


(ptb+p;-) 




{k-Kj)\ fc,! 


nfe {Pn-l+Pn) 


k-Kj 


kl 


J^Si — 2,n — 2 k^Lk_2 


[k - Kj) 


? ( n /l ) {Pn-l’’ +pt 


\3&J 




JGSi,n_2 fcG-Efc,j \iGJ 


We denote these four terms respectively by Ai{p), Bi{p), Ci{p) and Di{p). We thus have, for i > 2, 
Ti{p) = Ai(p) +Bi{p) — Ci(p) + Di{p). We have already shown that Ti{p) = Ai{p) +Z?i(p), so we 
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set Bi{p) = Ci{p) = 0. We then have 


P{re,„(p)>fc} = 

c—2 c—1 c—1 

= Ac-i{p) + '^{A,{p) -Ci+i{p)) + '^B,{p) + '^Di{p). 


(6) 


Z=1 


2=2 


2=1 


For i > 1, we have 


JeSi_i,„_ 2 fcGLfc_- ■'-<=7 J / 


- E E 

J^Si-l,n-2 k€Lk-2,J 


Pi 

■ r ^T 


k\ 


k 

p, 


{k - Kj) 


fcG-Efc-i,j ^ \jeJ ^ / 


t H* 


k-i 

Pi 


J^Si-l,rt-2 k^Ek-l,J 


By definition of the set we have Kj = k — 1 in the previous equality. This gives 

A,{p) - C^+i{p) = Y k\ (y[^\ {Pn-I+Pn) ■ 

Using the fact that the function x i —> is convex on interval [0,1] for every non negative integer 

s, we have 


,k-Kj , ,k-Kj 
Pn-1 +Pn 


— (Ap„_l + (1 — \)pn) '^ + ((1 ~ ^)Pn-l + Apn) ^ 

< Ap^lf ^ + (1 - A)p^^^ + (1 - \)pt.V + A^r^-' 


and in particular p'n_i +p'n= Pn-i + Pn- It follows that 

Ac-i{p') < Ac-i{p), 

A, {p') - Ci+i{p') = A,{p) - C^+l{p), 

B, {p') = Bi{p), 

D,{p') = Di{p), 


and from m that V{Tc^n{p') > k} < P{Tc_„(p) > k}, which concludes the proof. 


The function P{Tc^ti(p) > k}, as a function of p, being symmetric, this theorem can easily be 
extended to the case where the two entries p„_i and of p are any Pi^Pj G {pi,... ,p„}, with 

In fact, we have shown in this theorem that for fixed n and A:, the function of p, P{Tc,„(p) < fc}, 
is a Schur-convex function, that is, a function that preserves the order of majorization. See [7] for 
more details on this subject. 

Theorem 2 For every n > 1 and p = (pi,...,p„) G (0,1)” with Ed=iPi ~ I> 
c = 1,..., n, we have Tc^„(u) <st Tc^n(p), where u = (1/n,..., 1/n) is the uniform distribution. 
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Proof. To prove this result, we apply successively and at most n — 1 times Theorem [T] as follows. 
We first choose two different entries of p, say pi and pj such that pi < Ijn < pj and next to define 
p' and p' by 

/ 1 j / 1 

p, = - andp- =p, +pj -. 

n n 

This leads us to write = Xpi + (1 — X)pj and p'j = (1 — X)pi + Apj, with 


^ ^ pj - 1 /^ 

P] - Pi 

From Theorem [1] vector p' obtained by taking the other entries equal to those of p, i.e., by taking 
p^ = pe, for £ ^ i,j, is such that P{Tc_„(p') > fc} < P{Tc_„(p) > k}. Note that at this point vector 
p' has at least one entry equal to 1/n, so repeating at most n — 1 this procedure, we get vector u, 
which concludes the proof. ■ 


To illustrate the steps used in the proof of this theorem, we take the following example. Suppose 
that n = 5 and p = (1/16,1/6,1/4,1/8,19/48). In a first step, taking i = 4 and j = 5, we get 

p(i) = (1/16,1/6,1/4,1/5, 77/240). 


In a second step, taking i = 2 and j = 5, we get 

p(2) = (1/16,1/5,1/4,1/5,69/240). 
In a third step, taking i = 1 and j = 3, we get 

p(3) = (1/5,1/5,9/80,1/5,69/240). 
For the fourth and last step, taking i = 3 and j = 5, we get 

p(4) = (1/5,1/5,1/5,1/5,1/5). 


2.2 The case po > 0 

We consider now the case where po > 0. We have p = (pi,... ,Pn) with pi + • • • + Pn < 1 and 
Po = 1 — (pi + • • • +Pn)- Recall that in this case Tc^nijp) is the time or the number of steps needed 
to collect a subset of c different coupons among coupons 1,... ,n. Coupon 0 is not allowed to 
belong to the collection. As in the previous subsection we denote, for i = 0,1,..., n and fc > 0, 

(/c) 

by AF ^ the number of coupons of type i collected at instants l,...,fc. We then have for all 
ko,ki,... ,kn >0 such that X]r=o have 


= ko, TVf) = fci,..., = kn} = 


k\ 


ko\ki\ 




■Pn 


which can also be written as 


=ko, iV}") = fci,..., fVW = kn} 


koj ki\■■■kj \l-po 


Pn 


1 -Po 


(7) 


Note that p/(l — Po) is a probability distribution since 


1 

1 -Po 


= 1, 

2 = 1 
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so summing over all the fci,..., A;„ > 0 such that ki = k — k^, we get, for all fco = Oj ■ • ■) k, 

= ko} = -Po)"-"“. (8) 

From © and (O we obtain, for all fci,..., fc„ >0 such that K = k — ko, 

P{iV<« I “ ... 


(9) 

(k) 

Recall that Un is the number of coupon’s types among 1,..., n already drawn at instant k. We 
clearly have, with probability 1, = 0, and, for i = 0,..., n, 

P{C7^'=) = i} = ^ > 0, u G J and = 0, u ^ J}. 

J&Si,n 

Moreover, we have as in Subsection oi 

Tc,n{p) >k^ C/W < c. 

and so 

P{Te,„(p) > k = fco} 

C— 1 

= ^ ^ IP{iVW > 0, u G J and = 0, u ^ J | = ko}. 

i=0 JGSi,„ 


Using Relation ([5]), we obtain 

nTcAp)>k\N^^^ = ko} = j2 E E n 


c-l 


/ 


fe)' 

ki ! 


( 10 ) 


i=0 JGSi,„ keEk-ko,J \jeJ 

where the set Ekj has been defined in Subsection 2.1. 

Theorem 3 For every n > 1 and p = {pi,... ,pn) G (0,1)” with Y^^=iPi < 
c = 1,... ,n, we have Tc^„{u) <st Tc,n{v) <st Tc^nip), where u = (1/n,..., 1/n), v = (ui,..., u„) 
with Vi = {I- po)/n and po = I - Yn^iPi- 

Proof. From Relation (|31) and Relation (ITU)) , we obtain, for all fcg = 0,..., k, 

P{T,,„(p) > k I = fco} = P{T,,„(p/(l -po)) >k- fco}. (11) 

Using ([5]) and unconditioning, we obtain 

^{TcAp) > fc} = E - Po)"-'P{Te.„(p/(l - Po)) > fc - f}. (12) 

e=o ^ ^ 

Since p/(l —po) is a probability distribution, applying Theorem[2]to this distribution and observing 
that M = u/(l — Po), we get 

pm,„(p)>fc} = ^ Qp^(i-po)'=-^p{r,,„(p/(i-po)) >fc-n 

E -Po)'=-'P{re.„(u) > fc - n 

f=0 ^ ' 

E Q)po(i-po)'=-'P{r.,„(u/(i-po)) >k-i} 


> 


P{'U:,„(u) > fc}. 
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where the last equality follows from m- This proves the second inequality. 

To prove the first inequality, observe that P{Tc^„(p/(l — Po)) > is decreasing with i. This 
leads, using (EH) , to 

IP{T'c.n(p) > k} > P{Tc,n(p/(l -po)) > k}. 

Taking p = u in this inequality gives 

^{Tc,n{v) > k} > P{Tc,„(u) > k}, 


which completes the proof. ■ 


In fact, we have shown in the proof of this theorem and more precisely in Relation (EH) and 
using Theorem [2] that for fixed n,k and ko, the function of p, P{Tc,„(p) < k \ = ko} is a 

Schur-convex function, that is, a function that preserves the order of majorization. In particular, 
from (fT^ . P{Tc,„(p) < k} is also a Schur-convex function, even when po > 0. See [7] for more 
details on this subject. 

3 Distribution maximizing the distribution of Tc,n{p) 

We consider in this section the problem of stochastically maximizing the time Tc^nip) when p 
varies in a closed subset of dimension n. In the previous section the minimization was made on 
the set A defined, for every n and for all po S [0,1), by 


A={p= (pi,... ,pn) e (O,!)” I Pi H-hp„ = I -po}. 


According to the application described in the Section 4, we fix a parameter 9 £ (0, (1 —po)/n\ and 
we are looking for distributions p which stochastically maximizes the time Tc^n{p) on the subset 
Ag of A defined by 

Ag = {p= (pi,. .. ,Pn) £ A\pj >0, for every j = I,..., n}. 

The solution to this problem is given by the following theorem. We first introduce the set Bg 
defined by the distributions of Ag with all their entries, except one, are equal to 9. The set Bg 
has n elements given by 

= {( 7 , S,...,9),{9,-f,9,...,9),...,{9,...,9, 7 )}, 

where 7 = 1 — po — (n — 1)9. Note that since 9 £ (0, (I — po)/n], we have 1 — po — (n — 1)9 > 9 
which means that Bg C Ag. 


Theorem 4 For every n > 1 and p = (pi,...,p„) £ Ag and for all c = l,...,n, we have 
Tc,n{p) <st Tc^n{q), for every q £ Bg. 


Proof. Since P{Tc^„(p) > k} is a. symmetric function of p, P{Tc_„(g) > k} has the same value 
for every q £ Bg, so we suppose that qi = 9 for every £ ^ j and qj = 7. 

Let p £ Ag \ Bg and let i be the first entry of p such that i j and pt > 9. We then define 
the distribution p^^) as p-^^ = 9, p^-^^ = + pj — 9 > pj and pf^'^ = pi, for i ^ i,j. This leads us 

to write pi = Ap-^^ + (1 — Pj = (1 “ ^)Pi^'’ + ^ 


.( 1 ) 


A = 


■P^ 


Pj 


,-9 


_ pW Pj - 9 + Pi - 9 


e[o,i). 


From Theorem[Tl we get P{Tc,„(p) > fc} < P{Tc^„(p^^)) > k}. Repeating the same procedure from 
distribution p^^^ and so on, we get, after at most n — 1 steps, distribution g, that is P{Tc^„(p) > 
k} < P{Tc_„((;) > fc}, which completes the proof. ■ 




To illustrate the steps used in the proof of this theorem, we take the following example. Suppose 
that n = 5, 6 — 1/20, po = 1/10 and q = (1/20,1/20,1/20, 7/10,1/20), which means that j = 4. 
Suppose moreover that p = (1/16,1/6,1/4,1/8, 71/240). We have p € Ae and q G Bg. In a first 
step, taking i = 1 and since j = 4, we get 

= (1/20,1/6,1/4,11/80,71/240). 

In a second step, taking i = 2 and since j = 4, we get 

= (1/20,1/20,1/4,61/240,71/240). 

In a third step, taking z = 3 and since j = 4, we get 

= (1/20,1/20,1/20,109/240, 71/240). 

For the fourth and last step, taking i = 5 and since j = 4, we get 

pW = (1/20,1/20,1/20, 7/10,1/20) = q. 

4 Application to the detection of distributed denial of ser¬ 
vice attacks 

A Denial of Service (DoS) attack tries to progressively take down an Internet resource by flooding 
this resource with more requests than it is capable to handle. A Distributed Denial of Service 
(DDoS) attack is a DoS attack triggered by thousands of machines that have been infected by a 
malicious software, with as immediate consequence the total shut down of targeted web resources 
{e.g., e-commerce websites). A solution to detect and to mitigate DDoS attacks is to monitor 
network traffic at routers and to look for highly frequent signatures that might suggest ongoing 
attacks. A recent strategy followed by the attackers is to hide their massive flow of requests over 
a multitude of routes, so that locally, these requests do not appear as frequent, while globally 
each of these requests represent a portion 0 of the network traffic. The term “iceberg” has been 
recently introduced [lOj to describe such an attack as only a very small part of the iceberg can be 
observed at each single router. The approach adopted to defend against such new attacks is to 
rely on multiple routers that locally monitor their network traffic, and upon detection of potential 
icebergs, inform a monitoring server that aggregates all the monitored information to accurately 
detect icebergs. Now to prevent the server from being overloaded by all the monitored information, 
routers continuously keep track of the c (among n) most recent distinct requests. These requests 
locally represent at least a fraction 9 of the local stream. Once collected, each router sends them 
to the server, and throw away all the requests i that appear with a probability pi smaller than 9. 
The sum of these small probabilities is represented by probability pq. Parameter c is dimensioned 
so that the frequency at which all the routers send their c last requests is low enough to enable 
the server to aggregate all of them and to trigger a DDoS alarm when needed. This amounts 
to compute the distribution of the time Tc^nip) needed to collect c distinct requests among the 
n ones. Theorem [3] shows that the distribution p that stochastically minimizes the time Tc^nip) 
is the almost uniform distribution v. This means that if locally each router receives a stream in 
which all the frequent requests (that is, those whose probability of occurrence is greater than or 
equal to 9) occur with same probability, then the complementary distribution of the time needed 
to locally complete a collection of c distinct requests is minimized. As a consequence the delay 
between any two interactions between a router and the server is minimized. 

Another important aspect of DDoS detection applications is their ability to bound the detection 
latency of global icebergs, that is the maximal time that elapses between the presence of a global 
iceberg at some of the routers and its detection at the server. This can be implemented through a 
timer that will fire if no communication has been triggered between a router and the server, which 
happens if locally a router has received less than c requests. Dimensioning such a timer amounts to 
determine the distribution of the maximal time it takes for a router to collect c distinct requests. 
Theorem |T] shows that the distributions p that stochastically maximizes this time Tc^n(j>) are all 
the distributions q € Bg. 
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